14 September 2026
Reference: CVE-2025-54988
1. What is being reported?
The report describes a high-risk vulnerability in Apache Tika, a tool used to extract information from files like PDFs. The flaw allows attackers to exploit XML features inside a PDF to read private data or send harmful requests to other systems. This affects versions 1.13 through 3.2.1 of Apache Tika and related packages.
2. What this means in plain English
If your organisation uses software that relies on Apache Tika to handle PDFs, this vulnerability could let attackers access confidential information or disrupt your systems by sending malicious commands. This could lead to data breaches or other security problems.
3. Could this affect a small business?
Small businesses or charities that use software incorporating Apache Tika’s PDF parsing might be at risk, especially if they handle PDFs from external sources. If you do not use software that depends on Apache Tika, you are unlikely to be affected.
4. What to do now
- Check with your IT provider or software supplier if your systems use Apache Tika, especially for PDF processing.
- Ensure that any software using Apache Tika is updated to version 3.2.2 or later, which fixes this vulnerability.
- Avoid opening suspicious or unexpected PDF files from unknown sources until the update is applied.
- Ask your IT provider to review your security settings to detect and block potentially harmful PDF files.
5. Ask your IT provider
Can you confirm if any of our software uses Apache Tika for PDF processing, and if so, has it been updated to version 3.2.2 or later to fix the recent security vulnerability?
6. Bottom line
Update Apache Tika-related software promptly to protect your organisation from this serious PDF security flaw.
Information based on CISA KEV, NVD, and reputable security reports.